updated_info

User Enumeration Switch -


Carrier Access -600  Tier 1  Switches  If set   for  Logon permissions

If you type in a username  it will display  Incorrect  or  Correct

Before procedding to the  password  field


A  Person can  detect  Usernames on the system  through

a  basic brute force script  and output the values  into a  file  I/O  etc.......



Also


There  is  no Brute Force  Security to detect Logins

Although there is a  Audit trail that  shows  login information  once logged in

it does not disconnect you from the service  and  you can continue    bruteforceing
logins




By Hex00010






iPump 6400 Series


You can get the  Login Credentials  to the  Administration page    on the  iPump 6400 Series

by going to

/secure/js/login.js

Code  =


function Login() {
	var done=0;
	var username=document.login.username.value;
	var password=document.login.password.value;
	password=password.toLowerCase();
	if (password=="PASSWORD") { window.location="admin.php?user="+username+""; done=1; }
	if (password=="PASSWORD") { window.location="playout.php?user="+username+""; done=1; }
	if (password=="PASSWORD) { window.location="playlist.php?user="+username+""; done=1; }
	if (done==0) { alert("Invalid Login. Please check your password"); document.login.password.value = "";}
}


iPump  6400 Series  when  at the login page  the  field - Username  does not apply


it is there  just for the hell of it  - the only thing that matters is the password field


By - Hex00010  - Like a Boss - Runnin Solo since  0011  xD

- Not Fot Sale xD






SSL .Gov  -  Read my other pastebin to get  more info on the SSL certs

http://www.sendspace.com/file/hwzc8r




Atmail  -    File Permissions  Error




Powered by Atmail 6.20.8


/config/dbconfig.ini


Powered by Atmail
Powered by Atmail 6
Powered by Atmail 6.3.6
Powered by Atmail 6.2
Powered by Atmail 6.3





E2050 LANHP-IB   Config Utility  Requires  no  Auth Login






Techno Vision Security Systems -
%s
http://213.8.130.170/

Unhandled exception at 0x73257325 in iexplore.exe: 0xC0000005: Access violation.


String Format  --  %s   username field